CVE-2019-12524: Critical severity Squid-Cache Squid vulnerability
An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via urlregex. The handler for urlregex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the urlregex check, and gain access to the blocked resource.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-12524?
CVE-2019-12524 is a vulnerability discovered in Squid through version 4.7.
What is the severity of CVE-2019-12524?
CVE-2019-12524 has a severity rating of critical with a CVSS score of 9.8.
What is the affected software for CVE-2019-12524?
The affected software for CVE-2019-12524 includes Squid versions up to and including 4.7, Debian Linux versions 9.0 and 10.0, and Canonical Ubuntu Linux versions 16.04 and 18.04.
How does CVE-2019-12524 impact Squid?
CVE-2019-12524 allows unauthorized users to access detailed server information meant for the maintainer through the Cache Manager in Squid.
How can CVE-2019-12524 be fixed?
To fix CVE-2019-12524, it is recommended to update Squid to version 4.8 or apply the provided patch. Additionally, Debian and Ubuntu users should update to the specified versions of Squid.